@blumintinc/eslint-plugin-blumint 1.20.189 → 1.20.191

package/lib/index.js

@@ -223,7 +223,7 @@ function noFrontendImportsFromFunctionsPatterns(pattern) {
 module.exports = {
     meta: {
         name: '@blumintinc/eslint-plugin-blumint',
-        version: '1.20.189',
+        version: '1.20.191',
     },
     parseOptions: {
         ecmaVersion: 2020,

package/lib/rules/no-entire-object-hook-deps.js

@@ -1255,6 +1255,110 @@ exports.noEntireObjectHookDeps = (0, createRule_1.createRule)({
             return typeInfo;
         }
         const sourceCode = context.getSourceCode();
+        /**
+         * The variable each reference resolves to, keyed by the referencing
+         * identifier NODE rather than by name.
+         *
+         * why: identity keying is what makes the orphan check below immune to
+         * shadowing — a name lookup would resolve an inner `hydrated` against an
+         * outer binding of the same name and read its uses as survivors.
+         */
+        let variableByReference = null;
+        function resolveBinding(identifier) {
+            if (!variableByReference) {
+                variableByReference = new Map();
+                for (const scope of sourceCode.scopeManager?.scopes ?? []) {
+                    for (const variable of scope.variables) {
+                        for (const reference of variable.references) {
+                            variableByReference.set(reference.identifier, variable);
+                        }
+                    }
+                }
+            }
+            return variableByReference.get(identifier) ?? null;
+        }
+        /**
+         * Every identifier that a hook dependency array holds as an entry.
+         *
+         * why: an entry is a recompute trigger rather than a consumer of the value,
+         * so it cannot keep a declaration alive once the entries are pruned. The
+         * set is built from the rule's own notion of a dependency array — the last
+         * argument of a hook call — so it can never disagree with what the fixer
+         * edits. Keying on the identifier NODE, rather than on ancestry walked from
+         * a reference, keeps the answer available for entries the traversal has not
+         * reached yet, which is precisely the later-hook entry that #2210 turns on.
+         */
+        let dependencyEntryIdentifiers = null;
+        function collectDependencyEntryIdentifiers() {
+            if (dependencyEntryIdentifiers) {
+                return dependencyEntryIdentifiers;
+            }
+            const entries = new Set();
+            const visit = (node) => {
+                if (node.type === utils_1.AST_NODE_TYPES.CallExpression && isHookCall(node)) {
+                    const deps = node.arguments[node.arguments.length - 1];
+                    if (deps && deps.type === utils_1.AST_NODE_TYPES.ArrayExpression) {
+                        for (const entry of deps.elements) {
+                            if (entry)
+                                entries.add(unwrapExpression(entry));
+                        }
+                    }
+                }
+                forEachChildNode(node, visit);
+            };
+            visit(sourceCode.ast);
+            dependencyEntryIdentifiers = entries;
+            return entries;
+        }
+        /**
+         * Whether removing `element`'s binding from every dependency array that
+         * lists it would leave the binding with no reader in the file.
+         *
+         * why: a value declared and then read ONLY inside dependency arrays is by
+         * construction load-bearing — the declaration would be pointless otherwise
+         * — so removing any one entry discards a deliberate recompute trigger, and
+         * removing all of them strands the declaration. The consumer runs
+         * `no-unused-vars` as an error and builds with `noUnusedLocals`, so the
+         * rewrite turns a green file red on their machine while staying green here.
+         * Every sibling instance of this class was fixed by deleting the stranded
+         * declaration too, but that remedy is unavailable here: the declaration is
+         * a hook CALL, and dropping it changes the component's hook order.
+         * Declining the edit is the only safe remedy, so the report stands and the
+         * autofix steps aside.
+         *
+         * The verdict deliberately ignores which entry is under repair. A test
+         * scoped to one report's own range calls a sibling array's entry a
+         * survivor, and when two hooks list the same unread dependency both reports
+         * reach that conclusion, both fixes apply in one pass, and the binding is
+         * stranded after all (#2210). Discounting every entry instead gates on a
+         * property this fixer owns: no other fixer can manufacture a
+         * non-dependency read, so no sibling edit can move the answer. The
+         * inference is safe in the conservative direction — if a sibling report is
+         * suppressed the cost is a withheld fix, never a dangling reference.
+         *
+         * Parameters are deliberately exempt. An unread parameter is not an unused
+         * BINDING to either instrument — `no-unused-vars` runs with `args: 'none'`
+         * and `noUnusedLocals` does not cover parameters — so declining there would
+         * withhold a fix without preventing any breakage, and it would silently
+         * settle the reporting question #1621 defers.
+         */
+        function wouldStrandBinding(element) {
+            const identifier = unwrapExpression(element);
+            if (identifier.type !== utils_1.AST_NODE_TYPES.Identifier)
+                return false;
+            const variable = resolveBinding(identifier);
+            if (!variable || variable.defs.length === 0)
+                return false;
+            if (variable.defs.some((def) => def.type === 'Parameter')) {
+                return false;
+            }
+            const entries = collectDependencyEntryIdentifiers();
+            // why: a declarator's own initializer counts as a WRITE reference, so a
+            // survivor test that accepts any reference never fires for `const x = …`
+            // — the shape this check exists for (#1868 is the same trap).
+            return !variable.references.some((reference) => reference.isRead() &&
+                !entries.has(reference.identifier));
+        }
         // why: scanning every comment once per file rather than once per hook call
         // keeps the check off the hot path of files with many hooks.
         let manuallyManagedLines = null;
@@ -1373,6 +1477,10 @@ exports.noEntireObjectHookDeps = (0, createRule_1.createRule)({
                                     const elementIndex = depsArg.elements.indexOf(element);
                                     if (elementIndex === -1)
                                         return null;
+                                    // The report stands either way; only the rewrite is withheld.
+                                    if (wouldStrandBinding(element)) {
+                                        return null;
+                                    }
                                     // If this is the only element, just remove it
                                     if (depsArg.elements.length === 1) {
                                         return fixer.remove(element);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blumintinc/eslint-plugin-blumint",
-  "version": "1.20.189",
+  "version": "1.20.191",
   "description": "Custom eslint rules for use within BluMint",
   "author": {
     "name": "Brodie McGuire",

package/release-manifest.json

@@ -1,4 +1,32 @@
 [
+  {
+    "version": "1.20.191",
+    "date": "2026-08-29T19:38:08.123Z",
+    "rules": [
+      {
+        "name": "no-entire-object-hook-deps",
+        "changeType": "fix",
+        "issues": [
+          2210
+        ],
+        "summary": "discount every dependency entry from the strand check (closes #2210)"
+      }
+    ]
+  },
+  {
+    "version": "1.20.190",
+    "date": "2026-08-29T13:41:20.482Z",
+    "rules": [
+      {
+        "name": "no-entire-object-hook-deps",
+        "changeType": "fix",
+        "issues": [
+          2209
+        ],
+        "summary": "decline a removal that strands its binding (closes #2209)"
+      }
+    ]
+  },
   {
     "version": "1.20.189",
     "date": "2026-08-29T11:57:05.586Z",